Privacy Policy

Overview

Infiforge is a software company that builds and operates software products and technological solutions across web, mobile, and desktop. We are designed around a privacy-first principle: we collect the minimum information necessary to run our products, we never sell your data, and you always know what is collected and why.

Information We Collect

We collect the minimum information necessary to provide and improve our products:

• Account information: When you create an account, we collect your email address and/or phone number, and a username. If you use passwords, they are hashed with Argon2. If you use passkeys, only your public key is stored — your private key never leaves your device.
• Linked provider information: If you link Google, Microsoft, or Apple, we store a reference to that provider and the identity it verified. OAuth tokens are encrypted at rest.
• Product usage data: We collect anonymized, aggregated data about system health and uptime to operate our products reliably. This cannot be linked to individual users.
• Audit events: We record authentication and authorization events for security and debugging. This includes timestamps and outcomes — not the content of your activity within any product.

Information We Do NOT Collect

We explicitly do not collect the following:

• The content of your activity inside any product you use
• Files, messages, or documents you create in our products
• Your private passkeys or biometric data
• Raw passwords — only Argon2 hashes
• Tracking cookies or advertising identifiers

How We Use Information

The information we collect is used solely for:

• Providing secure authentication across our products
• Running, maintaining, and improving the software we build
• Processing payments for project engagements and retainers
• Sending service-related communications (authentication links, billing notices, security alerts)
• Complying with legal obligations (if legally required and consistent with our commitments)

Data Sharing and Third Parties

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We may share information with:

• Payment processors: To process project and retainer payments. These processors are bound by data processing agreements and do not use your data for their own purposes.
• Infrastructure providers: We use cloud infrastructure for hosting. These providers have access to the data stored on their systems but are contractually prohibited from using it for any other purpose.
• Legal authorities: We will only disclose information if legally compelled by a valid court order or legal process.

Data Retention

We retain your account information for as long as your account is active. If you delete your account, we delete your personal information within 30 days. Security logs are retained as required for auditing, typically 90 days to 7 years. Billing records are retained as required by applicable tax and financial regulations, but payment card numbers are not stored by us.

Security

We implement appropriate technical and organizational measures to protect your information, including: encryption at rest and in transit, Argon2 password hashing, RSA-signed JWTs verified via JWKS, encrypted OAuth tokens at rest, tamper-evident audit logs, regular security audits, and penetration testing. Core authentication and authorization libraries are open source for independent review.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access personal information we hold about you
• Request correction or deletion of your personal information
• Object to or restrict processing of your personal information
• Data portability
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with a data protection authority

To exercise these rights, contact us at hello@infiforge.com.

Cookies

Our website uses cookies strictly necessary for session management and authentication. We do not use tracking cookies, analytics cookies, or advertising cookies.

International Transfers

Infiforge operates globally. Your information may be processed in countries where our infrastructure providers maintain servers. We ensure appropriate safeguards are in place for international data transfers, including Standard Contractual Clauses where required.

Changes to This Policy

We may update this privacy policy from time to time. We will notify users of material changes via email. Continued use of our products after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or our data practices, contact us at hello@infiforge.com.